Field-Level Policies

caller request
    |
    v
query.ApplyPolicy(ctx)     the only entry point; returns a guarded handle
    |
    v
sanitize                   drop or refuse denied fields, restrict operators,
                           enforce caps, inject aliases and forced predicates
    |
    v
existing DynamicWhere      untouched
    |
    v
transform                  mask, mutate, default, generalize, truncate, format
    |
    v
FilterResult.Policy        a PolicyTrace saying what the policy did

// Once, at startup. A second call is refused: the tier is read by every
// request thread, and a posture that can change mid-flight can be relaxed.
DwPolicy.Configure(new DwPolicyOptions
{
    Tier = DwTier.Convenience,
    HashSalt = secret,
});

// Once per request, never once per query.
var caller = await DwPolicy.PrepareAsync(
    new DwPolicyContext()
        .WithSubject(DwSubjectKind.User, userId)
        .WithSubject(DwSubjectKind.Role, "Support")
        .WithSubject(DwSubjectKind.Tenant, tenantId)
        .WithValue("TenantId", tenantId));

// Then query through the guarded handle instead of the raw IQueryable.
var result = await db.Employees.ApplyPolicy(caller).ToListAsync(filter);

[DwEntity(RequirePolicy = true)]        // an unguarded read throws
public class Employee
{
    [DwMask(MaskStrategy.Email), DwNoOrder]
    public string Email { get; set; }    // s*************@c******.com on the way out

    [DwForceWhere(Operator.Equal, Value = "true")]
    public bool IsActive { get; set; }   // ANDed into every guarded query

    [DwGeneralize(GeneralizeMode.Round, Step = 5000,
                  AllowAggregate = true, MinGroupSize = 5)]
    [DwNoOrder, DwAudit, DwCost(10)]
    public decimal Salary { get; set; }  // rounded; aggregatable over groups of 5+

    [DwDenied]
    public JsonDocument? WorkSchedule { get; set; }
}